Hijack this log

stevemcol

Hi

Had a bit of a drama with a nasty piece of malware tonight. Finally got rid using malwarebytes and the advice on the forum sticky, thanks.
Now things are on an even keel I thought I'd post a hijackthis log. Would appreciate it if the experts give it a once over.

Thanks in advance.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:34:17, on 12/07/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18928)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Avast Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\LimeWire\LimeWire.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Windows\system32\igfxext.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\taskeng.exe
C:\Users\Steve\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5332&r=2v350709c235l03c4zqm5t47m2x226
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5332&r=2v350709c235l03c4zqm5t47m2x226
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5332&r=2v350709c235l03c4zqm5t47m2x226
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5577
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\AVASTS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O16 - DPF: Garmin Communicator Plug-In - https://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast Software\Avast4\ashWebSv.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
--
End of file - 10286 bytes

Browntoa

can we see the malwarebytes log file as well to see what was on there

Browntoa

fix these

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

macman

OP, why are you still running Vista SP1? Your Windows Updates are over a year out of date.

Browntoa

was going to mention that when we knew it was clean

macman

Browntoa wrote: »

was going to mention that when we knew it was clean

A touch of Captain Mainwaring there..."I was wondering which of you men would be the first to spot that'...:D

stevemcol

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4052
Windows 6.0.6001 Service Pack 1 (Safe Mode)
Internet Explorer 8.0.6001.18928
12/07/2010 21:08:33
mbam-log-2010-07-12 (21-08-33).txt
Scan type: Quick scan
Objects scanned: 119676
Time elapsed: 5 minute(s), 11 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 151
Registry Values Infected: 12
Registry Data Items Infected: 3
Folders Infected: 15
Files Infected: 73
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\funwebproducts.datacontrol (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\TypeLib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{25560540-9571-4d7b-9389-0f166788785a} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\TypeLib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{b813095c-81c0-4e40-aa14-67520372b987} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{cff4ce82-3aa2-451f-9b77-7165605fb835} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\TypeLib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.2 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\TypeLib\{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{8e6f1832-9607-4440-8530-13be7c4b1d14} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{a9571378-68a1-443d-b082-284f960c6d17} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\.chatsessionplugin (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\TypeLib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\.chatsessionplugin.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\.htmlpanel (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\TypeLib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\.htmlpanel.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\.outlookaddin (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{adb01e81-3c79-4272-a0f1-7b2be7a782dc} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\.outlookaddin.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\.pseudotransparentplugin (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\TypeLib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\.pseudotransparentplugin.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\toolbar.settingsplugin (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\TypeLib\{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{53ced2d0-5e9a-4761-9005-648404e6f7e5} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\toolbar.settingsplugin.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\toolbar.toolbarplugin (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\toolbar.toolbarplugin.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\TypeLib\{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{938aa51a-996c-4884-98ce-80dd16a5c9da} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1 (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{84da4fdf-a1cf-4195-8688-3e961f505983} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\CLSID\{d9fffb27-d62a-4d64-8cec-1ff006528805} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\TypeLib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.) -> Quarantined and deleted .
HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.) -> Quarantined and deleted .

stevemcol

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted .
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Service (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\ (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\.OutlookAddin (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\.OutlookAddin (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ bar Uninstall (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\ (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@.com/Plugin (Adware.) -> Quarantined and deleted .

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ email plugin (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ email plugin (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\my web search bar search scope monitor (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdxudeus (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3popularscreensavers (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\funwebproducts (Adware.) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gqamub (Trojan.Agent.U) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tvohuvetidac (Trojan.Agent.U) -> Quarantined and deleted .

Registry Data Items Infected:
HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (secfile) Good: (exefile) -> Quarantined and deleted .
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted .

Folders Infected:
\FunWebProducts (Adware.) -> Quarantined and deleted .
\FunWebProducts\ScreenSaver (Adware.) -> Quarantined and deleted .
\FunWebProducts\ScreenSaver\Images (Adware.) -> Quarantined and deleted .
\ (Adware.) -> Quarantined and deleted .
\\bar (Adware.) -> Quarantined and deleted .
\\bar\1.bin (Adware.) -> Quarantined and deleted .
\\bar\Avatar (Adware.) -> Quarantined and deleted .
\\bar\firefox (Adware.) -> Quarantined and deleted .
\\bar\firefox\chrome (Adware.) -> Quarantined and deleted .
\\bar\Game (Adware.) -> Quarantined and deleted .
\\bar\History (Adware.) -> Quarantined and deleted .
\\bar\icons (Adware.) -> Quarantined and deleted .
\\bar\Message (Adware.) -> Quarantined and deleted .
\\bar\Notifier (Adware.) -> Quarantined and deleted .
\\bar\Settings (Adware.) -> Quarantined and deleted .

Files Infected:
\\bar\1.bin\MWSOEMON.EXE (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3SRCHMN.EXE (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3DTACTL.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3HISTSW.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3HTMLMU.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3POPSWT.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3MSG.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3HTML.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3OUTLCN.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3SKIN.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\MWSBAR.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3SCRCTR.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\MWSSRCAS.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3CJPEG.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3HTTPCT.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3REPROX.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\MWSOEPLG.DLL (Adware.) -> Quarantined and deleted .
C:\Windows\System32\f3PSSavr.scr (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3BKGERR.JPG (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3HKSTUB.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3PSSAVR.SCR (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3REGHK.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3RESTUB.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3SCHMON.EXE (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3SPACER.WMV (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3WALLPP.DAT (Adware.) -> Quarantined and deleted .
\\bar\1.bin\F3WPHOOK.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\FWPBUDDY.PNG (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3AUXSTB.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3DLGHK.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3HIGHIN.EXE (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3IDLE.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3IMPIPE.EXE (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3MEDINT.EXE (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3PLUGIN.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3SKPLAY.EXE (Adware.) -> Quarantined and deleted .
\\bar\1.bin\M3SLSRCH.EXE (Adware.) -> Quarantined and deleted .
\\bar\1.bin\MWSOESTB.DLL (Adware.) -> Quarantined and deleted .
\\bar\1.bin\MWSSVC.EXE (Adware.) -> Quarantined and deleted .
\\bar\Avatar\COMMON.F3S (Adware.) -> Quarantined and deleted .
\\bar\firefox\CHROME.MANIFEST (Adware.) -> Quarantined and deleted .
\\bar\firefox\INSTALL.RDF (Adware.) -> Quarantined and deleted .
\\bar\firefox\NPMYWEBS.DLL (Adware.) -> Quarantined and deleted .
\\bar\firefox\chrome\M3FFXTBR.JAR (Adware.) -> Quarantined and deleted .
\\bar\Game\CHECKERS.F3S (Adware.) -> Quarantined and deleted .
\\bar\Game\CHESS.F3S (Adware.) -> Quarantined and deleted .
\\bar\Game\REVERSI.F3S (Adware.) -> Quarantined and deleted .
\\bar\icons\CM.ICO (Adware.) -> Quarantined and deleted .
\\bar\icons\MFC.ICO (Adware.) -> Quarantined and deleted .
\\bar\icons\PSS.ICO (Adware.) -> Quarantined and deleted .
\\bar\icons\SMILEY.ICO (Adware.) -> Quarantined and deleted .
\\bar\icons\WB.ICO (Adware.) -> Quarantined and deleted .
\\bar\icons\ZWINKY.ICO (Adware.) -> Quarantined and deleted .
\\bar\Message\COMMON.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\COMMON.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\DOG.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\FISH.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\KUNGFU.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\LIFEGARD.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\MAID.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\MAILBOX.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\OPERA.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\ROBOT.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\SEDUCT.F3S (Adware.) -> Quarantined and deleted .
\\bar\Notifier\SURFER.F3S (Adware.) -> Quarantined and deleted .
\\bar\Settings\s_pid.dat (Adware.) -> Quarantined and deleted .
C:\Users\Steve\Favorites\_favdata.dat (Malware.Trace) -> Quarantined and deleted .
C:\Users\Steve\AppData\Local\wqdstteec\vmobhggtssd.exe (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted .
C:\temp (Trojan.Dropper) -> Quarantined and deleted .
C:\Users\Steve\AppData\Local\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted .
C:\Users\Steve\AppData\Local\ajeneqehexop.dll (Trojan.Agent.U) -> Quarantined and deleted .
C:\Users\Steve\AppData\Local\nra01042.dll (Trojan.Agent.U) -> Quarantined and deleted .
C:\Users\Steve\AppData\Local\Temp\0.20122897018856722.exe (Trojan.Dropper) -> Quarantined and deleted .
.
\MyWebSearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3SCRCTR.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3CJPEG.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3HTTPCT.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3REPROX.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
C:\Windows\System32\f3PSSavr.scr (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3REGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3RESTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3SCHMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\FWPBUDDY.PNG (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\M3AUXSTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\M3DLGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\firefox\CHROME.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\firefox\INSTALL.RDF (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\firefox\NPMYWEBS.DLL (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\firefox\chrome\M3FFXTBR.JAR (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> Quarantined and deleted .
\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted .
C:\Users\Steve\Favorites\_favdata.dat (Malware.Trace) -> Quarantined and deleted .
C:\Users\Steve\AppData\Local\wqdstteec\vmobhggtssd.exe (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted .
C:\temp (Trojan.Dropper) -> Quarantined and deleted .
C:\Users\Steve\AppData\Local\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted .
C:\Users\Steve\AppData\Local\ajeneqehexop.dll (Trojan.Agent.U) -> Quarantined and deleted .
C:\Users\Steve\AppData\Local\nra01042.dll (Trojan.Agent.U) -> Quarantined and deleted .
C:\Users\Steve\AppData\Local\Temp\0.20122897018856722.exe (Trojan.Dropper) -> Quarantined and deleted .

stevemcol

I shaved some repeated strings out of the log to try and make it small enough to post. Such as c:\program files the word 'successfully' etc

aliEnRIK

The malwarebytes log is quite a bit out of date
Please UPDATE it and runa FULL scan (Not a quick one) and post that log AFTER youve deleted everything it finds

stevemcol

Guys

I've left malwarebytes running a full scan. I'll post the log when I get home tonight.
Regarding your comments about the system being out of date. Yes, a bit odd. I always install MS updates, the last one being early July. And the Malwarebytes, I downloaded yesterday from a recent link on the sticky.